Re: One-line URI body spam

2011-10-21 Thread Alex
Hi, >> > body            __BODY_URI      m{https?://.{1,50}$} >> >> That will match any email that ends with http:// followed by 1 to 50 >> characters of anythings, including spaces and other stuff not part of the >> url.  "$" is not "I want stuff to stop matching here."  It's the end. >> Either o

proper rule writing for N

2011-10-21 Thread R - elists
as you know, some emailing companies have multiple domains for mail serving mailengine1.com mailengine2.com mailengine3.com . . . mailengineN.com among other domains... what is the proper way to write a single rule to deal with N series combinations? header __LOCAL_MAILENGINE1 ALL =~ /maileng

Re: proper rule writing for N

2011-10-21 Thread Bowie Bailey
On 10/21/2011 11:56 AM, R - elists wrote: > as you know, some emailing companies have multiple domains for mail serving > > mailengine1.com > mailengine2.com > mailengine3.com > . > . > . > mailengineN.com > > among other domains... > > what is the proper way to write a single rule to deal with N s

RE: proper rule writing for N

2011-10-21 Thread R - elists
> There are a couple of ways to do it. > > If you know that the numbers are 1-9, you could do this: > > header __LOCAL_MAILENGINE ALL =~ /mailengine[1-9]\.com/i > > (this is matching a single character. You could NOT do [1-12]) > > If you just want to allow for a number, you could do this:

Re: proper rule writing for N

2011-10-21 Thread Bret Miller
You could say header __LOCAL_MAILENGINE ALL =~ /mailengine.+\.com/i to match anything between mailengine and .com. Bret Miller Manager, Information Technology Grace Communion International On 10/21/2011 9:13 AM, R - elists wrote: There are a couple of ways to do it. If you know that the

Re: proper rule writing for N

2011-10-21 Thread Bowie Bailey
On 10/21/2011 12:13 PM, R - elists wrote: > >> There are a couple of ways to do it. >> >> If you know that the numbers are 1-9, you could do this: >> >> header __LOCAL_MAILENGINE ALL =~ /mailengine[1-9]\.com/i >> >> (this is matching a single character. You could NOT do [1-12]) >> >> If you jus

Re: proper rule writing for N

2011-10-21 Thread Bowie Bailey
On 10/21/2011 12:16 PM, Bret Miller wrote: > You could say > header __LOCAL_MAILENGINE ALL =~ /mailengine.+\.com/i > > to match anything between mailengine and .com. The problem there is that this would match something like "mailengineblah.aol.com". This may or may not cause any issues, but it i

Re: proper rule writing for N

2011-10-21 Thread Daniel McDonald
On 10/21/11 11:21 AM, "Bowie Bailey" wrote: > On 10/21/2011 12:16 PM, Bret Miller wrote: >> You could say >> header __LOCAL_MAILENGINE ALL =~ /mailengine.+\.com/I Indeterminate length matches are almost never good. How about something like: header __LOCAL_MAILENGINE ALL =~ /\bmailengine[[:

Re: proper rule writing for N

2011-10-21 Thread John Hardin
On Fri, 21 Oct 2011, Daniel McDonald wrote: On 10/21/11 11:21 AM, "Bowie Bailey" wrote: On 10/21/2011 12:16 PM, Bret Miller wrote: You could say header __LOCAL_MAILENGINE ALL =~ /mailengine.+\.com/I Indeterminate length matches are almost never good. You can be a little less paranoid ab

Re: proper rule writing for N

2011-10-21 Thread Bowie Bailey
On 10/21/2011 12:35 PM, Daniel McDonald wrote: > On 10/21/11 11:21 AM, "Bowie Bailey" wrote: > >> On 10/21/2011 12:16 PM, Bret Miller wrote: >>> You could say >>> header __LOCAL_MAILENGINE ALL =~ /mailengine.+\.com/I > Indeterminate length matches are almost never good. How about something > lik

Re: proper rule writing for N

2011-10-21 Thread RW
On Fri, 21 Oct 2011 12:21:35 -0400 Bowie Bailey wrote: > On 10/21/2011 12:16 PM, Bret Miller wrote: > > You could say > > header __LOCAL_MAILENGINE ALL =~ /mailengine.+\.com/i > > > > to match anything between mailengine and .com. > > The problem there is that this would match something like > "

Re: all spam emails from mailengine1.com servers

2011-10-21 Thread Karsten Bräckelmann
This doesn't seem to deliberately be an off-list reply to sender, bouncing back to the list. On Fri, 2011-10-21 at 12:57 -0400, dar...@chaosreigns.com wrote: > On 10/21, Karsten Bräckelmann wrote: > > > header MAILENGINE1 Received =~ /mailengine1\.com/i > > > And in either case, do add some ancho

Re: all spam emails from mailengine1.com servers

2011-10-21 Thread Chip M.
R - elists wrote: >does anyone get legit emails that come from the mailengine1.com >email marketing servers? Yes, I've seen a trickle of ham, so did some data mining for you... The IP ranges I have for them are: 66.59.0.0 - 66.59.31.255 72.19.192.0 - 72.19.255.255 Does anyone h